CVE-2026-52736

Received Received - Intake

Zebra Node P2P Block Body Validation Bypass

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. In zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state recorded the hash in non_finalized_block_write_sent_hashes before contextual validation completed and did not remove it when the write task rejected the body. When the honest body later arrived, the cached hash caused KnownBlock::WriteChannel duplicate handling to suppress it, leaving the node stuck one height behind until restart or reorganization. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-52736

EUVD

EUVD-2026-61171

Affected Vendors & Products

Vendor	Product	Version / Range
zcashfoundation	zebra	4.4.1
zcashfoundation	zebra	4.4.2
zcashfoundation	zebra	4.5.0
zcashfoundation	zebra-state	6.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

CVE-2026-52736 is a block suppression vulnerability in Zebra, a Zcash node implementation. An attacker sends a poisoned block with a valid header hash but invalid transaction data, exploiting ZIP-244's separation of transaction IDs and signature validation. Zebra caches the invalid block hash before validation, causing it to reject the legitimate block later. This stalls the node at that block height until restart or reorg.

Detection Guidance

Detecting this vulnerability requires monitoring Zebra node behavior. Check if your node is stuck at a specific block height without advancing. Use Zebra's logs to look for duplicate block hash warnings or rejected valid blocks. Commands like `zebrad logs | grep -i "duplicate\|stuck\|rejected"` may help identify issues. Ensure your node is running version 4.5.0 or later to avoid the vulnerability.

If your node is running an older version, restarting it may temporarily resolve the issue by clearing the in-memory cache, but upgrading is the permanent fix.

Impact Analysis

This vulnerability can disrupt Zcash node operations, causing nodes to stall and fail to advance past a specific block height. It may impact downstream services like lightwalletd, wallets, explorers, and mining infrastructure that depend on the stalled node. Node operators may need to restart their nodes as a temporary workaround.

Mitigation Strategies

Immediately upgrade your Zebra node to version 4.5.0 or later to patch the vulnerability. If upgrading is not possible, reduce inbound peer connections to limit attack surface. Restart the node to clear the poisoned hash cache as a temporary measure.

Monitor node logs for signs of block suppression or stalling. Ensure downstream services like lightwalletd or explorers are not affected by the stalled node.

Hi! I’m here to help you understand CVE-2026-52736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70